Port SERVICEACCESS - IPSEC 🛈¶

Port for opening IPSEC-protected connections that can be used by other ports

Stimulation¶

This port has no stimulus capabilities.

Properties 🛈¶

Name	Default value	Valid values	Type	Description
Network name			string	Name of the network as defined in SIL-Kit Config yaml.
Controller name			string	Name of the controller as defined in SIL-Kit Config yaml.
MAC address ❲client❳	‘02:00:4C:4F:4F:50’		string	String (format: 02:00:4C:4F:4F:50), ‘default’ if the adapter MAC address should be used
IP address ❲client❳			string	IP address to be used as a client. It must be located in the same subnet as the IP address of the device under test, and must not be equal to the IP address of another participant.
Gateway address			string	IP address, leave empty if no gateway is needed
Subnet mask / prefix length	‘default’		string	For IPv4 addresses a subnet mask or prefix length can be given (format: ‘255.255.255.0’ or ‘24’). ‘default’ uses the default subnet mask of the network class of IP address (client). For IPv6 only a prefix length is accepted and the value ‘default’ is not supported.
VLAN ID	0		int	ID with which VLAN packets should be tagged. (0 -> VLAN is not used)
Certificates ecu.test			string	The certificate or certificates to use for identifying ecu.test. Separate with \| if there are multiple certificates.
Private key			string	Private key of the certificate used by ecu.test
root certificate			string	Root certificate for authentication of the remote peer’s certificate
Algorithms for IKEv2 protocol	‘[ENCR_AES_CBC:256, AUTH_HMAC_SHA2_384_192, PRF_HMAC_SHA2_384, DH_GROUP_20]’		string	List of algorithms to use for the IKEv2 protocol. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet).
Algorithms for Authentication Headers	‘[AUTH_AES_CMAC_96, ESN]’		string	List of algorithms/modes to use for Authentication Headers. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet).
Authentication Method	‘ECDSA_384’	[‘RSA’, ‘PSK’, ‘DSS’, ‘ECDSA_256’, ‘ECDSA_384’, ‘ECDSA_512’, ‘DIGITAL_SIGNATURE’]	string	Method used for authentication of the exchanged certificates. Only takes effect if ecu.test acts as initiator.
MTU	576		int	Default value 576 according to RFC 7383, section 2.5.1.
Do not stop IKEv2	☐		bool	IKEv2 stays active beyond test case execution.

Jobs 🛈¶

InitRekeying¶

Exchanges new keys for the specified session

Parameter

Name	Available if	Default value	Valid values	Type	Description
Protocol		‘AH’	[‘AH’, ‘IKE’]	string	Protocol whose key pairs should be renewed
SessionId				int	ID of an previously opened session

SendLivenessRequest¶

Actively sends a liveness request to the remote party

Parameter

Name	Available if	Default value	Valid values	Type	Description
SessionId				int	ID of an previously opened session

ShutdownConnection¶

Closes the specified session

Parameter

Name	Available if	Default value	Valid values	Type	Description
SessionId				int	ID of an previously opened session

StartAhManipulation¶

Starts an IPSEC AH manipulation (s. Header-Manipulation). The parameter value None is default and represents no manipulation. Parameters with the suffix “Flags” are not AH content. They are used to determine the type of manipulation. The valid values for this are in the parameter-specific description.

Parameter

Name	Type	Description
ICVFlags	int	AH: ICV Flags: None = no manipulation, 1 = set invalid ICV
NextHeader	int	AH: 8 Bit Next Header
PayloadLen	int	AH: 8-bit payload length in 4-octets minus 2
Reserved	ByteStream	AH: 16-bit reserved area (default 0x0000)
SessionId	int	ID of an previously opened session
SNFlags	int	AH: Sequence Number Flags: None = SNStart is absolute, 1 = SNStart is relative to current SN
SNStart	int	AH: 32 Bit Sequence Number Start is applied once after StartAhManipulation. See SNFlags.
SNStep	int	AH: Sequence Number Step is applied to each additional packet after the initial packet.
SPI	int	AH: 32-bit Security Parameters Index

StartIkeManipulation¶

Starts an IKE manipulation (s. IKE-Manipulation).

Parameter

Name	Available if	Default value	Valid values	Type	Description
Manipulator				object	A ByteStream or a custom manipulation object that is dynamically applied to IKE packets to be sent (s. IKE Manipulation).

StartupConnection¶

Starts initialization and authentication according to IKEv2 protocol with the specified remote station

Parameter

Name	Default value	Valid values	Type	Description
AhAlgorithms			string	List of algorithms/modes to use for Authentication Headers. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet). An empty string will default to the TBC option.
AuthType		[‘RSA’, ‘PSK’, ‘DSS’, ‘ECDSA_256’, ‘ECDSA_384’, ‘ECDSA_512’, ‘DIGITAL_SIGNATURE’]	string	Method used for authentication of the exchanged certificates. Only takes effect if ecu.test acts as initiator. An empty string will default to the TBC option.
Cert			string	The certificate or certificates to use for identifying ecu.test. Separate with \| if there are multiple certificates. An empty string will default to the TBC option.
DpdDelay	0		int	Time (in seconds) to wait after the last received message from the remote party until a liveness request is sent. Delay 0 means: no dead peer detection
IkeAlgorithms			string	List of algorithms to use for the IKEv2 protocol. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet). An empty string will default to the TBC option.
LocalIp			string	Differing client IP address. Used to override the TBC “IP address (client)” option. An empty string will default to the TBC option.
Mtu			int	MTU for packets. If None, the value from the TBC is used.
PrivateKey			string	Private key of the certificate which should be used by ecu.test. An empty string will default to the TBC option.
RootCert			string	Root certificate for authentication of the remote party’s certificate. An empty string will default to the TBC option.
SourceIpRange			string	Eigener IP-Adressbereich, in dem IPsec angewendet werden soll
SourcePortRange	‘1-499, 501-65535’		string	Eigener Portbereich in dem IPsec angewendet werden soll
TargetIp			string	Remote IP address
TargetIpRange			string	IP-Adressbereich der Gegenstelle, in dem IPsec angewendet werden soll
TargetPortRange	‘1-499, 501-65535’		string	Portbereich der Gegenstelle, in dem IPsec angewendet werden soll
Timeout	5		int	Timeout (in seconds) waiting for incoming messages

Return value

Name	Available if	Default value	Valid values	Type	Description
SessionId				int	ID of an previously opened session

StopAhManipulation¶

Stops an IPSEC-AH manipulation (s. Header Manipulation).

Parameter

Name	Available if	Default value	Valid values	Type	Description
SessionId				int	ID of an previously opened session

StopIkeManipulation¶

Stops the IKE manipulation (s. IKE-Manipulation).

WaitForConnectionStartup¶

Waits for the specified remote site to attempt to start initialization and authentication according to the IKEv2 protocol

Parameter

Name	Default value	Valid values	Type	Description
AhAlgorithms			string	List of algorithms/modes to use for Authentication Headers. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet). An empty string will default to the TBC option.
AuthType		[‘RSA’, ‘PSK’, ‘DSS’, ‘ECDSA_256’, ‘ECDSA_384’, ‘ECDSA_512’, ‘DIGITAL_SIGNATURE’]	string	Method used for authentication of the exchanged certificates. Only takes effect if ecu.test acts as initiator. An empty string will default to the TBC option.
Cert			string	The certificate or certificates to use for identifying ecu.test. Separate with \| if there are multiple certificates. An empty string will default to the TBC option.
DpdDelay	0		int	Time (in seconds) to wait after the last received message from the remote party until a liveness request is sent. Delay 0 means: no dead peer detection
IkeAlgorithms			string	List of algorithms to use for the IKEv2 protocol. The syntax and a list of all supported algorithms are described in the help file (Tool tracetronic: Ethernet). An empty string will default to the TBC option.
LocalIp			string	Differing client IP address. Used to override the TBC “IP address (client)” option. An empty string will default to the TBC option.
Mtu			int	MTU for packets. If None, the value from the TBC is used.
PrivateKey			string	Private key of the certificate which should be used by ecu.test. An empty string will default to the TBC option.
RootCert			string	Root certificate for authentication of the remote party’s certificate. An empty string will default to the TBC option.
SourceIpRange			string	Eigener IP-Adressbereich, in dem IPsec angewendet werden soll
SourcePortRange	‘1-499, 501-65535’		string	Eigener Portbereich in dem IPsec angewendet werden soll
TargetIp			string	Remote IP address
TargetIpRange			string	IP-Adressbereich der Gegenstelle, in dem IPsec angewendet werden soll
TargetPortRange	‘1-499, 501-65535’		string	Portbereich der Gegenstelle, in dem IPsec angewendet werden soll
Timeout	5		int	Timeout (in seconds) waiting for incoming messages

Return value

Name	Available if	Default value	Valid values	Type	Description
SessionId				int	ID of an previously opened session

WaitForRekeying¶

Waits for the receiver of the specified session to start negotiating new keys

Parameter

Name	Available if	Default value	Valid values	Type	Description
SessionId				int	ID of an previously opened session
TimeToWait		10		int	Timeout (in seconds) waiting for receiver to initiate the exchange of new keys